2026-08-17_bbd4042760f7d2a53c3a7a08d25d5b14_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-17_bbd4042760f7d2a53c3a7a08d25d5b14_icedid_njrat_vidar
Size 4.7MB
Sample260817-fb13aatbpf
SHA256 285404a2d03f560a97fbfbaffd2d24266edd02ebc0497a8961def635543c192a
MD5 bbd4042760f7d2a53c3a7a08d25d5b14
SHA1 cb3d14318102f0d51385014b33d8083c0071b8c7
SHA512 684020b12535979c21edbaacab7c97022716834fd9701459745e7d601fc69f46b37def4bae88800b9c52a236403cd18f0213fa70071990cd047e17a05271156f
SSDEEP 49152:gdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2xzYo5UC9RhuCTFKlaxV5dgbT7WrTW:L/IJsiCxsop7cTqrYOm
TLSH
T174366C656BF880F5E1A7E134897AC9B2F77678020D71EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-17_bbd4042760f7d2a53c3a7a08d25d5b14_icedid_njrat_vidar

File Explorer

2026-08-17_bbd4042760f7d2a53c3a7a08d25d5b14_icedid_njrat_vidar

.exe 4.7MB

2026-08-17_bbd4042760f7d2a53c3a7a08d25d5b14_icedid_njrat_vidar

IMPHASH d3751ab33b3858f3b8b8d3275495baba
SHA256 285404a2d03f560a97fbfbaffd2d24266edd02ebc0497a8961def635543c192a
MD5 bbd4042760f7d2a53c3a7a08d25d5b14
SHA1 cb3d14318102f0d51385014b33d8083c0071b8c7
SHA512 684020b12535979c21edbaacab7c97022716834fd9701459745e7d601fc69f46b37def4bae88800b9c52a236403cd18f0213fa70071990cd047e17a05271156f
SSDEEP 49152:gdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2xzYo5UC9RhuCTFKlaxV5dgbT7WrTW:L/IJsiCxsop7cTqrYOm
TLSH
T174366C656BF880F5E1A7E134897AC9B2F77678020D71EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2315552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\dec\target\x64\ship\click2run\x-none\IntegratedOffice.pdb

gdi32

GetDeviceCaps

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

advapi32

RegCreateKeyExW RegCloseKey EventWriteTransfer EventRegister EventUnregister RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegSetValueExW RegDeleteValueW GetTokenInformation IsValidSid GetSidSubAuthorityCount GetSidSubAuthority RegNotifyChangeKeyValue RevertToSelf EventWrite OpenThreadToken OpenProcessToken GetLengthSid CopySid InitializeAcl AddAccessAllowedAce AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA CheckTokenMembership CreateWellKnownSid EqualSid

kernel32

GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentProcess GetLastError CompareStringEx IsWow64Process MultiByteToWideChar RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer SetLastError DeactivateActCtx ActivateActCtx LoadLibraryW FindActCtxSectionStringW CreateActCtxW GetModuleFileNameW GetModuleHandleExW QueryActCtxW OutputDebugStringA LocalFree FindClose UnmapViewOfFile CloseHandle CreateFileMappingA MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LCMapStringW FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetTickCount64 GetProcAddress K32GetProcessMemoryInfo GlobalMemoryStatusEx LeaveCriticalSection EnterCriticalSection LocalAlloc WideCharToMultiByte CreateEventW SetEvent InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW GetModuleHandleW LoadLibraryExW FindResourceW SizeofResource LoadResource VerSetConditionMask VerifyVersionInfoW OpenProcess GetCurrentProcessId GetStringTypeW GetVersionExW GetUserDefaultLocaleName IsValidCodePage SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl GetComputerNameW WriteConsoleW FormatMessageW GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW HeapFree HeapAlloc GetProcessHeap WaitForSingleObject CreateThread WaitForMultipleObjectsEx CreateEventExW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork ReleaseSemaphore WaitForSingleObjectEx QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace ReleaseMutex CreateMutexExW OpenMutexW GetTempPathW GetLongPathNameW ResetEvent QueryPerformanceCounter QueryPerformanceFrequency VirtualProtectEx GetSystemInfo GlobalFree GlobalAlloc ReadFile WriteFile GetFileSizeEx SetEndOfFile SetFilePointerEx GetOverlappedResult FlushFileBuffers CancelIoEx GetFileAttributesExW DeleteFileW CreateDirectoryW FindFirstFileExW FindNextFileW GetFileType GetTempFileNameW SetFileInformationByHandle GetFileInformationByHandleEx SignalObjectAndWait GetProcessAffinityMask GetLogicalProcessorInformationEx CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer GetTickCount WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus IsDebuggerPresent WaitForMultipleObjects GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW RtlCaptureContext GetModuleHandleA VirtualFree ExpandEnvironmentStringsW VirtualAlloc OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA ProcessIdToSessionId GetPriorityClass GetExitCodeProcess GetTimeZoneInformation IsValidLocale LCMapStringEx GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread GetACP SetStdHandle HeapReAlloc EnumSystemLocalesW GetTimeFormatW GetDateFormatW ExitProcess GetStdHandle HeapSize GetConsoleCP GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualQuery LoadLibraryExA GetLocalTime GetOEMCP RtlVirtualUnwind RtlLookupFunctionEntry GetLocaleInfoW CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader DuplicateHandle DeleteTimerQueueTimer CreateTimerQueueTimer GetUserGeoID GetSystemDefaultLCID

ole32

CoRevokeInitializeSpy CLSIDFromString CoTaskMemFree CoCreateInstance CoSetProxyBlanket IIDFromString StringFromGUID2 CoCreateGuid CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoCreateFreeThreadedMarshaler CoRegisterInitializeSpy CoTaskMemAlloc

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

107KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

626KB

Virtual Size

628KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-17_bbd4042760f7d2a53c3a7a08d25d5b14_icedid_njrat_vidar

gdi32

oleaut32

advapi32

kernel32

ole32

generic